Service abuse: Power BI shared document lure

calendar Oct 23, 2026  ·
Share on: linkedin copy

Detects inbound emails containing a link to app.powerbi.com with a /view path, combined with body text patterns commonly used to lure recipients into opening a supposedly shared document, file, or proposal. Attackers abuse Power BI's legitimate reporting platform to host and redirect to credential phishing pages, leveraging its trusted domain to bypass security filters and build recipient trust.

Sublime rule (View on GitHub)

 1name: "Service abuse: Power BI shared document lure"
 2description: "Detects inbound emails containing a link to app.powerbi.com with a /view path, combined with body text patterns commonly used to lure recipients into opening a supposedly shared document, file, or proposal. Attackers abuse Power BI's legitimate reporting platform to host and redirect to credential phishing pages, leveraging its trusted domain to bypass security filters and build recipient trust."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.domain == "app.powerbi.com"
 9          and strings.istarts_with(.href_url.path, "/view")
10  )
11  and regex.icontains(body.current_thread.text,
12                      'shared (?:a|an|the)\b[^.]{0,60}\b(?:document|file|proposal|folder|documentation)',
13                      'review the attached',
14                      'can only be (?:viewed|opened|accessed) (?:with|on|using)'
15  )  
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Social engineering"
20  - "Free file host"
21detection_methods:
22  - "URL analysis"
23  - "Content analysis"
24id: "ccb16eb3-dfa6-59ac-8590-93848e303375"
to-top